CVE-2023-6610: Kernel: oob access in smb2_dump_detail

An Out-Of-Bounds Read vulnerability in smb2dumpdetail in fs/smb/client/smb2ops.c in the Linux Kernel. This flaw could allow a local attacker to crash the system or leak internal kernel information.

Refer: https://bugzilla.kernel.org/showbug.cgi?id=218219

1] If CONFIGCIFSDEBUG2 is set, then cifsdemultiplexthread calls dumpdetail.

static int cifsdemultiplexthread(void p) { ... for (i = 0; i < nummids; i++) { if (mids[i] != NULL) { mids[i]->respbufsize = server->pdusize;

if (bufs[i] != NULL) { if (server->ops->isnetworknamedeleted && server->ops->isnetworknamedeleted(bufs[i], server)) { cifsserverdbg(FYI, "Share deleted. Reconnect needed"); } }

if (!mids[i]->multiRsp || mids[i]->multiEnd) mids[i]->callback(mids[i]);

releasemid(mids[i]); } else if (server->ops->isoplockbreak && server->ops->isoplockbreak(bufs[i], server)) { smb2addcreditsfromhdr(bufs[i], server); cifsdbg(FYI, "Received oplock break\n"); } else { cifsserverdbg(VFS, "No task to wake, unknown frame received! NumMids %d\n", atomicread(&midcount)); cifsdumpmem("Received Data is: ", bufs[i], HEADERSIZE(server)); smb2addcreditsfromhdr(bufs[i], server); #ifdef CONFIGCIFSDEBUG2 if (server->ops->dumpdetail) server->ops->dumpdetail(bufs[i], server);//[1] cifsdumpmids(server); #endif / CIFSDEBUG2 / } } //[2]In smb2dumpdetail, calcsmbsize is called, which refers to smb2calcsize.

static void smb2dumpdetail(void buf, struct TCPServerInfo server) { #ifdef CONFIGCIFSDEBUG2 struct smb2hdr shdr = (struct smb2hdr )buf;

cifsserverdbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, shdr->Id.SyncId.ProcessId); cifsserverdbg(VFS, "smb buf %p len %u\n", buf, server->ops->calcsmbsize(buf));//[2] #endif } In hassmb2dataarea, it attempts to retrieve an element at the index le16tocpu(shdr->Command). If a value larger than the length of hassmb2dataarea is input, an OOB (Out-Of-Bounds) Read occurs."

unsigned int smb2calcsize(void buf) { struct smb2pdu pdu = buf; struct smb2hdr shdr = &pdu->hdr; int offset; / the offset from the beginning of SMB to data area / int datalength; / the length of the variable length data area / / Structure Size has already been checked to make sure it is 64 / int len = le16tocpu(shdr->StructureSize);

/ StructureSize2, ie length of fixed parameter area has already been checked to make sure it is the correct length. / len += le16tocpu(pdu->StructureSize2);

if (hassmb2dataarea[le16tocpu(shdr->Command)] == false)//[3] goto calcsizeexit;